“What would you do first if we gave you a thousand pounds?” Almost nobody asks it, and it is the most useful question available. The answer is nearly always the same and it is unglamorous: turn on multi-factor authentication everywhere, especially on email; get patching working automatically on laptops rather than servers; test that your backups actually restore onto a machine that is not the one they came from; and spend half a day with your finance team on what a supplier bank-change request looks like when it is fraudulent. That is roughly a thousand pounds of our time and it removes the causes of nine of the eleven incidents we have handled since 2021. Anybody who answers that question with a product name rather than a list of tasks is selling rather than advising, and you should treat the rest of their proposal accordingly.

Three questions will separate a security firm that is assessing your business from one that is selling you a package, and you can ask all three on a first call. First: “what would you look at before quoting?” A real answer names things — how many devices, who has administrator rights, whether anyone still uses a shared login, what happens to a laptop when somebody leaves. A sales answer names a tier. Second: “what is the cheapest thing that would meaningfully help us?” Anybody who cannot answer that below a thousand pounds is not thinking about your business, because for most organisations under fifty people the answer genuinely is multi-factor authentication and tested backups. Third: “what have you got wrong recently, and what changed afterwards?” A practice that has been doing this for a decade has made mistakes and will tell you about them; a firm that claims none either has not been trading long or is not being straight with you. We publish ours on the credentials page for exactly this reason. None of that is specific to us — ask a competitor the same three and compare the answers, which is a better use of a morning than reading anybody’s brochure.

Ring 01422 419 381 rather than reading any further. That is the incident line and it is answered around the clock for retained clients; if you are not retained we will still help and we will tell you what it costs before we start, but do not sit reading a website. In the meantime, three things: do not turn the affected machine off, because volatile memory is often where the useful evidence is, and pulling the network cable achieves the containment without destroying it. Do not delete the suspicious email — forward a copy with full headers if you can, but leave the original where it is. And if money has moved, ring your bank before you ring us; the recall window on a faster payment is measured in hours and we cannot do that part for you. Everything else can wait forty minutes for somebody who does this for a living.